Discrete Logarithm Problem

Transcription

1 Discrete Logarithm Problem

2 Finite Fields The finite field GF(q) exists iff q = p e for some prime p. Example: GF(9) GF(9) = {a + bi a, b Z 3, i 2 = i + 1} = {0, 1, 2, i, 1+i, 2+i, 2i, 1+2i, 2+2i} Addition: (a + bi) + (c + di) := (a + c) + (b + d)i Multiplication: (a + bi)(c + di) = ac + (ad + bc)i + bdi 2 For instance, (1 + 2i) + (1 + i) = 2 + 0i = 2 (1 + 2i)(1 + i) = (1 + 2) + ( )i = 2i (1 + i) 2 = (1 + 1) + ( )i = 2 = (ac + bd) + (ad + bc + bd)i

3 Finite Fields Consider the powers of i: i, i 2 = i+1, i 3 = i 2 + i = 2i + 1, i 4 =(i 2 ) 2 = (i+1) 2 = 2, i 5 = (i 4 )i = 2i, i 6 =(i 4 )(i 2 ) = 2+2i, i 7 = 2 + i, i 8 = 1 An element of a field whose powers give all the non-zero elements of that field is called a primitive element of the field. If F is a finite field, the set F\{0} of non-zero elements is denoted by F* and is a (cyclic) group under multiplication. A primitive element of F is also called a generator of F*. Not all the elements of F* are primitive. 2, 2 2 = 1 i+1, (i+1) 2 = 2, (i+1) 3 = 2i + 2, (i+1) 4 = 1

4 Square and Multiply Let F = GF(q) and take α as a primitive element of F. Any c F* has a unique representation as c = α m, for 0 m q-1. c can be computed from α and m with only 2 log 2 q multiplications. The binary representation of m gives the order of the needed multiplications, which consist only of squaring and multiplying by α. For instance, if m = 171 then 171 = = ( ) 2 and the computation of α 171 is carried out by starting with 1, then, working from the most significant bit down, we square the current value and if there is a 1 in the binary representation we also multiply by α. Thus, α 171 = ((((((((1) 2 α) 2 ) 2 α) 2 ) 2 α) 2 ) 2 α) 2 α.

5 Discrete Logarithm Problem On the other hand, given c and α, finding m is a more difficult proposition and is called the discrete logarithm problem. If taking a power is of O(t) time, then finding a logarithm is of O(2 t/2 ) time. And this can be made prohibitively large if t = log 2 q is large.

6 Diffie-Hellman Key Exchange The difficulty of taking logarithms makes exponentiation in a finite field a one-way function (not a trapdoor function however). This can be used in a public key exchange protocol. Public knowledge is p, and α m U for each user U, while each user keeps secret their value of m U. To exchange keys without transmission, A looks up B's public key and exponentiates it with his own secret exponent. B does the same to A's public key. Thus, each of them calculates the same key value α m B m A α m A m B mod p. There does not appear to be any means of obtaining this value without first finding one of the secret exponents... i.e., solving the discrete logarithm problem for this q. Diffie & Hellman suggest using a value of p which is at least 100 bits long.

7 Diffie-Hellman Key Exchange One problem with this protocol is that there is only one key that the two users can use. A variation which permits different keys (called session keys) to be used is: Public information: prime p and generator of Z p α. Protocol: A chooses a random secret exponent a, with 0 < a < p-1. A computes α a mod p and sends this to B. B chooses a random secret exponent b, with 0 < b < p-1. B computes α b mod p and sends this to A. A computes the key K = (α b ) a mod p while B computes the key K = (α a ) b mod p.

8 Man in the Middle Attack A new problem arises with this variant. If Oscar is capable of altering the messages between Alice and Bob (an active rather than passive adversary), then Oscar can change Alice's original α a to his own α c and similarly change Bob's original α b to his own α c. Now, all communication between Alice and Bob has to go through Oscar in order to be decrypted. That is, a message from Alice is decrypted by Oscar, possibly altered, and then encrypted by Oscar to send to Bob. This man-in-the-middle attack can be thwarted by the use of a signature scheme. After receiving α a from Alice, Bob sends the pair (α b, sig B (α a,α b )) from which Alice can verify that α b has not been altered from what Bob sent. Alice then sends sig A (α a,α b ) to Bob so that he can verify the α a that Alice originally sent.

9 El-Gamal Cryptosystem For a prime p which is intractible (i.e., very large), let α be a generator of Z p *. Each user selects a secret element a Z p-1 and makes public the value β α a mod p. Thus, α, β, and p are publicly known. To send a message, Alice randomly selects a secret k Z p-1 and if x is the message, sends the ordered pair (α k, x β k ) mod p, where β is Bob's β. To decrypt, Bob raises the first component to his secret exponent a, finds the inverse mod p of this number, and multiplies the second component by this inverse to get the message back. This computation is, (x β k ) (α ka ) -1 = x β k (β k ) -1 x mod p.

10 Shank's Algorithm This algorithm is known as a Time-Memory Trade Off, that is, if you have enough memory at your disposal you can use it to cut down the amount of time it would normally take to solve the problem. Let p be a prime, α a generator of Z p *. We wish to find a, given β where β α a mod p. Let. 1: Compute α mj mod p for 0 j m-1. 2: Sort the pairs (j, α mj mod p ) by second coordinate in a list L 1. 3: Compute βα -i mod p for 0 i m-1. 4: Sort the pairs (i, βα -i mod p ) by second coordinate in a list L 2. 5: Find a pair in each list with the same second coordinate, i.e., (j, y) L 1 and (i, y) L 2. 6: a mj + i mod (p-1). m= p 1

11 Pohlig-Hellman Algorithm There are certain cases in which the discrete logarithm problem can be solved in less than O( q) time, for instance when q-1 has only small prime divisors. An algorithm for dealing with this special case was developed in We first look at a special case: Suppose that q - 1 = 2 n. Let α be a primitive element in GF(q). Noting that in this case, q is odd, we have α (q-1)/2 = -1. Let m, 0 m q-2, be the exponent of α that we wish to find, i.e. c = α m, and write m in its binary representation: m = m 0 + m m m n-1 2 n-1. Now, c q 1 q 1 q 1 2 = m 2 = m 0 m 1 2 m n 1 2 n 2 2 = m 0 So the evaluation of c (q-1)/2 which costs at most 2 log 2 q operations, yields m 0. q 1 2 = 1if m 0=0 1if m 0 =1

12 Pohlig-Hellman Algorithm We then determine c 1 = cα -m 0, and repeat the basic computation again to obtain m 1. c 1 q 1 q 1 2 = m 1 m 2 2 m n 1 2 n 2 2 = m q = 1if m 1=0 1if m 1 =1 This procedure can then be repeated until each of the m i are obtained. The total number of operations is thus n (2 log 2 q + 2) O ( (log 2 q) 2 ). The general case is dealt with by repeating the analogue of the special case for each of the prime factors of q-1 and then combining the results using the Chinese Remainder Theorem.